Suspicious Activity Reporting 
Public Safety Telecommunications Training 


Acts of domestic and international terrorism did not end with 
9/11—in fact, they continue to grow and threaten the United 
States, its citizens, and its critical infrastructure. 


Reporting suspicious activity to law enforcement provides leads to 


further investigations and helps prevent crime, including terrorism. 


In the course of their daily duties and responsibilities, public safety 
telecommunications professionals may receive information during 
their interactions with the public regarding suspicious activity that 
could be an indicator of emerging homeland security threats of 
targeted violence and mass casualty attacks, to include those 
related to terrorism. This online training video was developed to 
assist public safety telecommunications professionals in: 


Recognizing what kinds of suspicious behaviors are 
associated with pre-incident terrorism activities. 


Understanding how and where to report suspicious activity. 


Protecting privacy, civil rights, and civil liberties when 
reporting or documenting information. 


Public safety telecommunications professionals can incorporate 
this video into their training programs for current or newly hired 
personnel. 


Nationwide Suspicious Activity 

Reporting (SAR) Initiative (NSI) 

This training was developed by the Nationwide Suspicious 
Activity Reporting (SAR) Initiative (NSI), a partnership of 
agencies at all levels that provides law enforcement with 
another tool to facilitate the reporting of crime and terrorism. 
The NSI has a national capacity for gathering, documenting, 
processing, analyzing, and sharing terrorism- related SARs. Visit 
the NSI Web site at htt yW hs.; si for resources to 
assist agencies in developing si increasing the effectiveness of 
their SAR processes and counterterrorism activities. 


For More Information: 


Hometown Security Partners 

The Suspicious Activity Reporting Public Safety 
Telecommunications Training is one in a series of 
trainings developed by the NSI. In addition to providing 
training for the law enforcement community, the NSI 
has developed this SAR awareness training for partners 
with similar missions, or “hometown security partners.” 


These partners include: 


e Public safety telecommunications professionals 
(e.g., 9-1-1 operators) 
Private sector security officers and personnel and 
those charged with protecting the nation’s critical 
infrastructure 
Probation, parole, and corrections professionals 
Fire and emergency medical services 
professionals 
Emergency management professionals 
Maritime industry professionals 
Public health and health care partners 


Training Available at No Cost 


The Suspicious Activity Reporting Public Safety 
Telecommunications Training is provided at no cost to 
public safety telecommunications professionals. 


To Access the Online Training 


Access the training through 
the NSI Web site at: 


<= : | https://www.dhs.gov/ 


DIAL 911 7 ~~ 
course/nsi-training- 


public-safety- 
Hite! telecommunications 


To contact the National Threat Evaluation and Reporting (NTER) Office, NSI 


program management team, email: NTER@hq.dhs.gov: 


Rev. 06/21 
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Behaviors 


Breach/Attempted 
Intrusion 


Misrepresentation 


Theft/Loss/Diversion 


Sabotage/Tampering/ 
Vandalism 


Cyberattack 


Expressed or Implied 
Threat 


Aviation Activity 


Suspicious Activity Reporting 
Indicators and Behaviors 


Descriptions 


Defined Criminal Activity and Potential Terrorism Nexus Activity 


Unauthorized personnel attempting to enter or actually entering a restricted area, secured protected site, or 
nonpublic area. Impersonation of authorized personnel (e.g., police/security officers, janitor, or other personnel). 


Presenting false information or misusing insignia, documents, and/or identification to misrepresent one’s affiliation as 
a means of concealing possible illegal activity. 


Stealing or diverting something associated with a facility/infrastructure or secured protected site (e.g., badges, 
uniforms, identification, emergency vehicles, technology, or documents {classified or unclassified}), which are 
proprietary to the facility/infrastructure or secured protected site. 


Damaging, manipulating, defacing, or destroying part of a facility/infrastructure or secured protected site. 


Compromising or attempting to compromise or disrupt an organization’s information technology infrastructure. 


Communicating a spoken or written threat to commit a crime that will result in death or bodily injury to another 
person or persons or to damage or compromise a facility/infrastructure or secured protected site. 


Learning to operate, or operating an aircraft, or interfering with the operation of an aircraft in a manner that poses 
a threat of harm to people or property and that would arouse suspicion of terrorism or other criminality in a 
reasonable person. Such activity may or may not be a violation of Federal Aviation Regulations. 


Potential Criminal or Non-Criminal Activities Requiring Additional Information During Vetting 


Note: When the behavior describes activities that are not inherently criminal and may be constitutionally protected, the vetting agency should 
carefully assess the information and gather as much additional information as necessary to document facts and circumstances that clearly 


support documenting the information as an ISE-SAR. 


Eliciting Information 


Testing or Probing of 
Security 


Recruiting/Financing 


Photography 


Observation/ 
Surveillance 


Materials Acquisition/ 
Storage 


Acquisition of Expertise 


Weapons Collection/ 
Discovery 


Sector-Specific Incident 


Questioning individuals or otherwise soliciting information at a level beyond mere curiosity about a public or private 
event or particular facets of a facility’s or building’s purpose, operations, security procedures, etc., in a manner that 
would arouse suspicion of terrorism or other criminality in a reasonable person. 


Deliberate interactions with, or challenges to, installations, personnel, or systems that reveal physical, personnel, or 
cybersecurity capabilities in a manner that would arouse suspicion of terrorism or other criminality in a reasonable 
person. 


Providing direct financial support to operations teams and contacts or building operations teams and contacts; 
compiling personnel data, banking data, or travel data in a manner that would arouse suspicion of terrorism or other 
criminality in a reasonable person. 


Taking pictures or video of persons, facilities, buildings, or infrastructure in an unusual or surreptitious manner that 
would arouse suspicion of terrorism or other criminality in a reasonable person. Examples include taking pictures 
or video of infrequently used access points, the superstructure of a bridge, personnel performing security functions 
(e.g., patrols, badge/vehicle checking), security-related equipment (e.g., perimeter fencing, security cameras), etc. 


Demonstrating unusual or prolonged interest in facilities, buildings, or infrastructure beyond mere casual (e.g., 
tourists) or professional (e.g., engineers) interest and in a manner that would arouse suspicion of terrorism or other 
criminality in a reasonable person. Examples include observation through binoculars, taking notes, attempting to 
mark off or measure distances, etc. 


Acquisition and/or storage of unusual quantities of materials such as cell phones, pagers, radio control toy servos or 
controllers; fuel, chemicals, or toxic materials; and timers or other triggering devices, in a manner that would arouse 
suspicion of terrorism or other criminality in a reasonable person. 


Attempts to obtain or conduct training or otherwise obtain knowledge or skills in security concepts, military weapons 
or tactics, or other unusual capabilities in a manner that would arouse suspicion of terrorism or other criminality in a 
reasonable person. 


Collection or discovery of unusual amounts or types of weapons, including explosives, chemicals, and other 
destructive materials, or evidence, detonations or other residue, wounds, or chemical burns, that would arouse 
suspicion of terrorism or other criminality in a reasonable person. 


Actions associated with a characteristic of unique concern to specific sectors (e.g., the public health sector), with 
regard to their personnel, facilities, systems, or functions in a manner that would arouse suspicion of terrorism or 
other criminality in a reasonable person. 


https://www.dhs.gov/nsi 
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